fix sonar

.github/workflows/static-analysis.yml

@@ -39,15 +39,23 @@ jobs:
     name: Sonar cloud
     runs-on: ubuntu-latest
     steps:
+      - name: Download coverage report
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-xml-report
+          path: coverage
       - uses: actions/checkout@v4
         with:
           # Number of commits to fetch. 0 indicates all history for all branches and tags.
           # Default: 1
           fetch-depth: 0
-      - uses: sonarsource/sonarcloud-github-action@master
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@master
         with:
           args: >
             -Dsonar.python.version=3.12
+            -Dsonar.sources=app
+            -Dsonar.python.coverage.reportPaths=coverage/coverage.xml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/test.yml

@@ -20,16 +20,21 @@ jobs:
         python -m pip install -r requirements/generated/requirements-testing.txt --upgrade pip
 
     - name: Test with pytest
-      env:
-          SECRET_KEY: 'TEST_KEY'
       run: |
         pip install pytest pytest-cov
-        pytest
+        coverage run -m pytest
+        coverage xml
 
     - name: Upload pytest test results
       uses: actions/upload-artifact@v4
       with:
         name: pytest-results
         path: junit/test-results.xml
       # Use always() to always run this step to publish test results when there are test failures
-      if: ${{ always() }}
+      if: ${{ always() }}
+
+    - name: Upload coverage report
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-xml-report
+        path: coverage.xml

sonar-project.properties

@@ -3,6 +3,6 @@ sonar.projectKey=ministryofjustice_laa-civil-case-api
 
 # relative paths to source directories. More details and properties are described
 # in https://sonarcloud.io/documentation/project-administration/narrowing-the-focus/
-sonar.sources=app
+sonar.sources=.
 sonar.tests=tests
 sonar.coverage.exclusions=app/db/migrations/**